Critical RCE Chain in a Ubiquitous Windows IME
Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical remote code execution flaw in Tencent's Sogou Input Method for Windows, to deploy a modular backdoor dubbed GrayRabbit. Sogou Input Method is one of the most widely installed Chinese-language input tools, giving the flaw an unusually large potential footprint.
The Threat Actor
The exploitation is attributed to UNC3569, a China-based group that operates across both state-aligned espionage and cybercrime-for-hire activity. That dual profile makes the group's toolset — and this exploit chain — a risk to a broad range of targets, not just government or defense-sector organizations.
Attack Chain
Exploitation requires only a single malicious click and chains three separate weaknesses:
| Stage | Weakness |
|---|---|
| 1. Protocol handler abuse | A crafted sgbiz: custom URI triggers unvalidated command-line argument injection in biz_helper.exe |
| 2. Unrestricted navigation | Attacker-controlled arguments direct Sogou's CEF-based webview to load malicious URLs without restriction |
| 3. Outdated browser engine | An unpatched, unsandboxed Chromium 80 engine executes the exploit and drops the GrayRabbit payload |
The reliance on a years-out-of-date, sandbox-free Chromium build embedded inside the input method is what turns a single URI click into full code execution.
GrayRabbit Backdoor Capabilities
The analyzed GrayRabbit variant is a modular backdoor offering attackers:
- Arbitrary process execution
- Interactive reverse shell access
- File upload and download
- System and user information collection
- In-memory plugin loading via reflection (helping it evade disk-based detection)
Patch Status
Tencent shipped a fix in Sogou Input Method version 16.3.0.3498 (released April 21, 2026), which validates URLs, restricts navigation to HTTPS, and limits it to approved domains. However, researchers note the underlying Chromium 80 engine itself remains outdated with security features still disabled — meaning the patched URI-validation logic closes this specific chain, but the broader attack surface persists.
Recommended Actions
- Update Sogou Input Method to version 16.3.0.3498 or later immediately.
- Audit systems for the presence of Sogou Input Method in environments where its use isn't expected or required.
- Monitor for
biz_helper.exespawning child processes or unexpected outbound network connections. - Block or restrict
sgbiz:URI handling at the endpoint level where the application isn't business-critical. - Treat any pre-patch installation as potentially compromised if it was exposed to untrusted links or content.